2F003 — prohibited_sql_statement_attempted
2F003
At a glance
The fixed scan confirms this ERROR in both dblink and postgres_fdw connection paths. dblink also reports it when a command would return rows where the dblink API expects no result. The authentication variants are wrapper/connection policy paths, not proof that every prohibited SQL statement uses this code.
| Field | Value |
|---|---|
| SQLSTATE | 2F003 |
| Condition | prohibited_sql_statement_attempted |
| Status | active |
| Known present by | 7.4 |
| Locked snapshots | 9.0.23, 9.1.24, 9.2.24, 9.3.25, 9.4.26, 9.5.25, 9.6.24, 10.23, 11.22, 12.22, 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19beta3 |
| Macros | ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED |
| Aliases | — |
Meaning
The confirmed messages include statement returning results not allowed, and authentication variants such as password or GSSAPI delegated credentials required with a detail and sometimes a hint. postgres_fdw adds detail about the user mapping and may hint at password_required=false; dblink has its own credential wording. Keep the producer because the same SQLSTATE covers separate APIs.
Messages
Confirmed messages include statement returning results not allowed, plus password or GSSAPI delegated credentials required, which carries detail and may also carry a hint depending on the path. postgres_fdw identifies the user mapping in its detail and one path mentions password_required=false in the hint; dblink uses its own credential wording. Because the same SQLSTATE covers separate APIs, retain the actual producer.
Diagnosis
For dblink, identify whether the local call is a row-returning command used through a no-result API or a connection credential check. For postgres_fdw, inspect the foreign-server connection, user mapping, authentication method, and the server’s password_required policy when the message names them. Preserve the fixed detail/hint and do not collapse dblink and postgres_fdw into one generic wrapper.
Response
Correct the command/API pairing or the named connection credentials and user mapping, then verify the remote operation. A remote connection attempt may not have completed; preserve the remote/local boundary before retrying. Do not change transaction policy merely because dblink or postgres_fdw reported 2F003.
Versions
The locked catalogue places this condition at least by PostgreSQL 7.4. The facts block lists the published snapshots; source-path status is limited to the fixed PostgreSQL 18.6 evidence below.
Related
Sources
Read the fixed dblink.c and postgres_fdw connection.c paths alongside the structured evidence record.